CVE-2026-37003: Agno vulnerability
Agno up to and including 2.5.8 is vulnerable to Remote Code Execution (RCE) via prompt injection. The PythonTools and ShellTools components pass unsanitized, LLM-generated arguments directly to execution sinks including exec(), runpy.runpath(), and subprocess.run(). An unauthenticated attacker can exploit this by embedding malicious instructions in content processed by the agent (such as web pages or documents), allowing for arbitrary code and OS command execution on the host server.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
Agno deployments using affected versions up to and including 2.5.8 are exposed when an agent processes attacker-controlled content, such as web pages or documents, through PythonTools or ShellTools. The attack can be performed without authentication.
What does an attacker need to exploit it?
The attacker needs to embed malicious instructions in content that the agent will process. The vulnerable components can pass LLM-generated arguments without sanitization to code or command execution functions.
What is the impact of successful exploitation?
Successful exploitation can allow arbitrary Python code execution and operating-system command execution on the host server.